Feeds

'Secure' PayPal page is... you guessed it

Extended SSL no match for the power of XSS

Choosing a cloud hosting partner with confidence

A serious scripting error has been discovered on PayPal that could enable attackers to create convincing spoof pages that steal users' authentication credentials..

The cross-site scripting bug is made all the more critical because it resides on a page that uses an extended validation secure sockets layer certificate. The new-fangled SSL mechanism is designed to give users a higher degree of confidence that the page they're visiting is secure by turning their browser address bar green.

But Finnish researcher Harry Sintonen figured out a way to inject his own code into a supposedly protected PayPal page even as the green bar lulled visitors into believing it hadn't been tampered with. Sintonen's code simply caused an Internet Explorer alert window to open with the words "Is it safe?" as evidenced by the screenshot below.

Screenshot showing PayPay XSS vulnerability

During an online interview, he demonstrated a page that prompted users for their account credentials and then sent them to an unauthorized server, and he said it would be possible for him to steal user cookies as well. All the while, the address bar would bear the PayPal URL in green. At time of publication, eBay had not yet removed the buggy code.

A statement from PayPal said the company considers user security a top priority. "As soon as we were informed of this exploit, we began working very quickly to shut it down," the statement read. "To our knowledge, this exploit was not used in any phishing attacks". Unauthorized withdrawals or purchases made on PayPal accounts are fully reimbursed.

The discovery is one more reason to remain skeptical of extended validation SSL, which has always struck us as a solution in search of a problem. Yes, we know it's supposed to close a loophole that's long existed in SSL by certifying, in this case for example, that it is eBay (the parent company of PayPal) that owns the SSL certificate for the specific PayPal page. But we've not yet heard of a single attack involving a forged certificate, so we're tempted to think the measure is more gimmick designed to generate revenue for VeriSign and its competitors than anything else.

eBay security pros seem to have drunk the EV SSL Kool Aid, however, having announced recently (PDF alert) that browsers that don't support the new standard aren't welcome on the PayPal site.

XSS vulnerabilities have emerged as one of the easier and more common ways to subvert website security measures. They use manipulated URLs to get around the so-called same-origin policy, which prevents cookies and other types of content set by one domain from being accessed or manipulated by a different address.

Despite the proliferation of XSS attacks, McAfee's ScanAlert, which provides daily audits of ecommerce websites to certify them "Hacker Safe," gives clients the thumbs up even when XSS vulnerabilities are discovered on their pages. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.